Spanish police are buying drone systems that can follow vehicles, and European / national rules exist but watchdogs and courts are actively contesting broad ANPR-style mass collection. Below is a compact, sourced brief plus practical next steps you can take.

What I found (key points)

1. EFF warning / news coverage
   — The Electronic Frontier Foundation has flagged police use of drones paired with automated licence-plate readers (ALPR) as a significant privacy risk; recent coverage summarizing EFF’s concerns is circulating in tech press. Malwarebytes
2. Commercial rollout: Flock Safety’s drone ALPR push
   — Flock Safety (large ALPR vendor) has introduced a Drone / Drone-as-a-Service-ish product (Aerodome / Drone as First Responder features) that explicitly markets aerial plate-reading and fast response capability to police and enterprise customers. Vendor announcements and trade press show this technology is accelerating into deployments. flocksafety.com+2GovTech+2
3. Actual Spanish police procurement / capability
   — Spanish local police departments are actively acquiring drones and “matrícula” (plate) reading devices. Local reporting (example: Alcobendas) documents a municipal police force adding drones capable of following people/vehicles and also a PDA for plate reading. That shows the capability is entering Spanish police toolkits. Cadena SER+1
4. EU / Spanish drone regulation exists but doesn’t fully solve data-privacy questions
   — Spain enforces EASA/EU drone rules and recent national regulations (e.g., Royal Decree 517/2024) and operator registration via AESA; those rules cover aviation safety, operation categories and operator registration but are not primarily privacy-law instruments. Privacy issues around ALPR data fall into separate data-protection / national law domains. Aviation Security+1
5. Legal pushback over ANPR / mass plate-data collection in Europe
   — Civil-liberties groups across Europe are litigating and campaigning against mass, undifferentiated ANPR systems and long retention policies (examples: Privacy First lawsuit in the Netherlands and other EU discussions). These actions highlight the legal and proportionality questions that will shape how drone-ALPR can be used or limited. Privacy First+1

What the risks look like (brief)

• Mass surveillance: drones can collect plates from everyone in their flightpath, creating movement histories.
• Retention & sharing: collected logs may be stored long and shared across agencies/vendors.
• Mission creep: initially for emergency response or theft, can expand to broader monitoring (protests, political activity).
• Errors & harms: misreads can lead to wrongful stops; aggregated data can be used discriminatorily.
  (These risks are central to EFF and civil-liberties critiques.) Malwarebytes+1

Spanish / EU legal context — quick summary

• Aviation rules (EASA + Spain’s AESA / Royal Decree 517/2024) control how drones may be flown, operator registration, and safety categories — important for transparency (flight logs, operator identity) but not sufficient for data-use limits. EASA+1
• Data protection and surveillance use must be evaluated under EU data-protection laws (GDPR) and national privacy laws; however, many lawsuits argue current ANPR/ALPR regimes still allow disproportionate mass collection and poor oversight. Digital Freedom Fund+1

Practical next steps you (or your community) can take

1. Find out locally — Ask your municipal police / local council:
   • Do they operate drones? Which models and what sensors?
   • Do drones perform ALPR / plate reads? When and why?
   • What policies exist for retention, sharing, access, and oversight?
     (If you want, I can draft a short FOIA / transparency request in Spanish you can send to your Ayuntamiento or Policía Local.)
2. Request public records — In Spain, request: drone flight logs, procurement contracts (vendor names like Flock Safety, ADTEl, etc.), ALPR policies, retention schedules, and any data-sharing MOUs.
3. Push for strong safeguards — Advocate for: warrants or judicial authorization for location aggregation, short retention windows, independent audits, no sharing with immigration/federal bodies without explicit legal basis, and public reporting on flights/plate reads.
4. Support litigation & NGOs — Groups like the EFF, Privacy First (NL) and national civil-liberties orgs are already litigating and campaigning; supporting them (or following their reports) helps build legal pressure.